mwiede/jsch

Scanned on Jun 5, 2026

Risk score/ 100

High risk

Summary

JSch library has critical post-quantum cryptography vulnerabilities with 30 broken algorithm implementations and 165 quantum-vulnerable cryptographic primitives. The codebase extensively uses RSA, DSA, ECDSA, and legacy ciphers (3DES, Blowfish) that will be completely broken by quantum computers, creating significant long-term security and compliance risks. Immediate migration planning to NIST-approved post-quantum algorithms is essential for regulatory compliance and future-proofing.

Critical

High

165

Medium

Low

Top findings

Critical3DES / TripleDES

examples/ScpToNoneCipher.java:50

Raw evidence

session.setConfig("cipher.c2s", "none,aes128-cbc,3des-cbc,blowfish-cbc");

CriticalRSA key ≤ 2048 bits
src/main/java/com/jcraft/jsch/AgentProxy.java:128
Raw evidence
```
} else if (alg.equals("rsa-sha2-512")) {
```
CriticalRSA key ≤ 2048 bits
src/main/java/com/jcraft/jsch/ChannelAgentForwarding.java:210
Raw evidence
```
signature = identity.getSignature(data, "rsa-sha2-512");
```
CriticalRSA key ≤ 2048 bits
examples/KeyGenOpenSSHv1.java:14
Raw evidence
```
int key_size = 1024;
```

Critical3DES / TripleDES

examples/AES.java:44

Raw evidence

session.setConfig("cipher.s2c", "aes128-cbc,3des-cbc,blowfish-cbc");

+ 195 more findings in the full report

Scan your own repository

Free. Results in ~90 seconds. CBOM + DORA/NIS2 PDF included.

Start a free scan